National Cyber Security Awareness Month presents an opportunity every year to engage public and private sector stakeholders – especially the general public – to create a safe, secure, and
resilient cyber environment. Everyone has to play a role in cybersecurity. Constantly evolving cyber threats require the engagement of the entire nation — from government and law enforcement to the
private sector and most importantly, the public.

A cyber security risk assessment is necessary to identify the gaps in your organization’s critical risk areas and determine actions to close those gaps. It will also ensure that you invest time and
money in the right areas and do not waste resources where there is no need for it.

Cyber security risk assessment:

Use an in house qualified staff or an experienced consultant(s), who will work with your team to examine each of the ten risk areas (described below) in sufficient detail to identify strengths and weaknesses of your current security posture. All this information can be consolidated and immediately usable action remediation plan that will help you close the gap between what you are actually doing and recognized good practice. It will enable you to ensure that your cyber risk management at least matches minimum industry guidelines.

Do you have a monitoring strategy? Do you continuously monitor activity on ICT systems and networks, including for rogue wireless access points? Do you analyze network logs in real time, looking for evidence of mounting attacks? Do you continuously scan for new technical vulnerabilities?

Do you have a technical vulnerability patching program in place and is it up-to-date? Do you maintain a secure configuration for all ICT devices? Do you have an asset inventory of authorized devices and do you have a defined baseline build for all devices?

Do you protect your networks against internal and external attacks with firewalls and penetration testing? Do you filter out unauthorized or malicious content? Do you monitor and test security controls?

Do you have an incident response and disaster recovery plan? Is it tested for readily identifiable compromise scenarios? Do you have an incident forensic capability and do you know how to report cyber incidents?

Based on the Ten Steps To Cyber Security mentioned above DISC examines if you have appropriate measures in place for each of the ten critical information risk areas.

Report with your assessment results can be presented to senior management. This report will assist you to put a business case together for implementing tighter security controls to ensure your business is protected and that you meet minimum industry compliance requirements.